How to Force splunk to get timestamp of file created

[kannu]

Hello Splunkers ,

I have one csv file which gets dumped to location being monitored by splunk UF .

That csv contains content like this

19752,"TTYHUJIKNN",sdfsdfsdfsdfwer,sdfsdfsdf,,,"04-04-2019 12:11:31 PM","06-14-2019 09:30:18 AM"

Time stamp present in above logs will get changed when every time CSV get appended by new entry of logs ,
But i dont want splunk to indexed the event based on timestamp present in logs , i want data to get indexed with the time of creation of file
like provided below it should be Jul 9 01:28

-rwxr-xr-x 1 ccc ccc 13308953 Jul 9 01:28 Device_Report07-09-2019.csv
-rwxr-xr-x 1 ccc ccc 13311527 Jul 10 01:27 Device_Report07-10-2019.csv

For achieving this i have used props.conf at UF end .
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 1

But its not working as expected , Please help

[richgalloway · Accepted solution]

The UF won't do anything with those props.conf settings. Indexers and heavy forwarders will honor them, but they'll just end up throwing a ton of messages in splunkd.log.

Try putting DATETIME_CONFIG = NONE in the indexer's props.conf file. That's supposed to use the file's modification time. If that doesn't work, try DATETIME_CONFIG = CURRENT to use the current time for the events.

[raisomain]

from what i've tried (v_7.3.1), NONE would only insert timestamp if the event/line doesn't hv time info itself, CURRENT will override timestamp on all event/line.

[kannu]

Ok i , will try that

[FlorianScho]

Hi @kannu,

did this fix your problem?
Currently im facing the same, set DATETIME_CONFIG = Current - this inserts the file now in my configured schedule but only the headers of the CSV file.. 

Any suggestions?